EUVD-2026-86349
GHSA-xxcx-x8pw-23q4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file read of logs/bundles by a low-privileged actor (AV:L/PR:L/AC:L); disclosed admin creds yield high C plus chained I/A over managed switches, though S:C is arguable for the subsequent-system impact.
Primary rating from Vendor (brocade).
CVSS VectorVendor: brocade
Lifecycle Timeline
2DescriptionCVE.org
Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed authentication details to compromise managed network infrastructure and access active application sessions. This vulnerability affects Brocade SANnav versions before 3.0.1a.
AnalysisAI
Plaintext disclosure of administrative switch credentials and live session tokens in Brocade SANnav discovery-service log files lets anyone who can read those logs - or who is handed an exported support bundle - recover credentials that unlock the managed SAN fabric. All SANnav releases before 3.0.1a are affected, and the logging occurs under default configuration, so the only barrier is obtaining local read access to the log directory or bundle; the CVSS v3.1 assessment (8.5, AV:L/AC:L/PR:L/UI:N, C/I/A:H) and the vendor-published CVSS v4.0 vector (8.5) both place this at high severity because a successful read escalates into full compromise of managed switches and active user sessions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local read access to Brocade SANnav discovery-service log files or to an exported SANnav support bundle (AV:L, PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credible but access-gated risk rather than a mass-exploitation threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Brocade SANnav 3.0.1a - upgrading to this version is the only complete fix, since it removes the plaintext logging of administrative switch credentials and session tokens; consult the vendor advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38996 for the official upgrade procedure and any interim guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict filesystem permissions on SANnav discovery-service log directories and exported support bundles to the minimum necessary administrators, audit recent access to those logs and bundles, and rotate all administrative switch credentials and invalidate active sessions that may have been logged. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Incomplete log sanitization in Brocade SANnav before 3.0.1a causes extension switch IPsec pre-shared keys (PSKs) to be w
In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL
A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an
Brocade SANnav deployments running versions before 3.0.1a expose backend management service ports without adequate acces
Command injection in the Brocade SANnav CLI scripting component lets an authenticated user who already holds command-exe
Pre-shared keys used for IPsec tunnel configuration are recorded in cleartext inside application log files by Brocade SA
A vulnerability in the migration script for Brocade SANnav before 3.0 could allow the collection of database sql queries
In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored usin
In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Sup
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas
Cleartext credential exposure in the job scheduling component of Brocade SANnav causes external server passwords and arc
A vulnerability in update-reports-purge-settings.sh script logging for Brocade SANnav before 2.4.0a could allow the coll
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today